CVE-2022-42098

KLiK-SocialMediaWebsite version v1.0.1 Explication de la vulnérabilité : KLiK-SocialMediaWebsite v1.0.1 possède des vulnérabilités d'injection SQL sur profile.php au paramètre id. Vecteurs d'attaque : KLiK-SocialMediaWebsite v1.0.1 Une fois qu'un utilisateur a été créé, il peut également trouver...

CVE-2022-28986

CVE-2022-28986 Une vulnérabilité de type Insecure Direct Object References IDOR dans le "Simple 2FA Plugin for Moodle" par LMS Doctor Détails de la vulnérabilité Risque : Critique Fournisseur : LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Divulgué par : Flaviu Popescu Description...

CVE-2020-24913-exploit

qcubed-exploit Вам необходимо установить Bun: https://bun.sh Для установки зависимостей: bun install Для запуска: show help bun run exploit -h test for vulnerability bun run exploit vulnerable -u https://site.com/framework/assets/core/php/profile.php create a session for a new target bun run...

QCube Cross-Site-Scripting

A reflected cross-site scripting vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. id: CVE-2020-24912 info: name: QCube Cross-Site-Scripting author: pikpikcu severity: medium...

CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Projet V1.0/profile.php Injection SQL NOM DU PRODUITS CONCERNÉS AVL Rooms Page d'accueil du fournisseur https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ Soumetteur dazhi Fichier vulnérable /profile.php VERSIONS V1.0 Lien du...

CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-90501

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-88999 Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2025-25965

CVE-2025-25965 : Falsification de requête intersite CSRF dans Online Banquet Booking System v1.2 Introduction La falsification de requête intersite CSRF reste l'une des vulnérabilités les plus négligées mais pourtant dangereuses affectant les applications web aujourd'hui. CVE-2025-25965 est une...

CVE-2021-24545

CVE-2021-24545 Это XSS-уязвимость, обнаруженная в плагине, распространение которого в качестве плагина прекращено. WordPress Plugin HTML Author Bio description XSS Данная уязвимость возникает из-за неадекватной проверки параметра description в /wp-admin/profile.php. Удаленный злоумышленник может...

CVE-2020-24913-PoC

CVE-2020-24913-PoC PoC для CVE-2020-24913, уязвимость SQL-инъекции в qcubed все версии, включая 3.1.1 в profile.php через параметр strQuery позволяет неаутентифицированному злоумышленнику получить доступ к базе данных путем внедрения SQL-кода через специально созданный POST-запрос. Этот PoC...

CVE-2006-0450-phpBB-2.0.15-Multiple-DoS-Vulnerabilities

Neo Security Team NST® - Advisory 15 - 00/00/06 Programme : phpBB 2.0.15 Page d'accueil : http://www.phpbb.com Versions vulnérables : phpBB 2.0.15 et versions antérieures Risque : Risque élevé !! Impact : Multiples vulnérabilités DoS. Description phpBB est un package de forum open source puissant...

CVE-2026-93656

The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can i...

EUVD-2026-86596

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

CVE-2026-93656: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-82571

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

CVE-2026-54506 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

PT-2026-95141

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description A flaw exists in the way user profile bios are processed. The file 'app/controller/user/profile.php' accepts the userbio field and processes it using the sanitizeHTML function in...